feat(auth): add trusted reverse proxy / header authentication (#306)

fix(session-cookie): migrate to __Host- prefix for secure contexts (#294)

feat(refactor): ready for manual QA after main sync (#274)

fix(security): enforce server-side actor identity (#224)

feat(#159): add Agent-Level Identity & Attribution

fix: resolve cron calendar and auth regressions from open issues

feat: phase 1 workspace isolation across auth and core APIs (#112)

feat: audit hardening, webhook retry, and local Claude session tracking (#68)

feat: v1.2.0 — validation hardening, unit tests, quality improvements

fix: add auth checks on all GET endpoints, timing-safe comparisons, and XSS sanitization

feat: initial open-source release